An AUA (Authentication User Agency) uses UIDAI’s Yes/No Aadhaar authentication, while a KUA (e-KYC User Agency) uses its e-KYC facility. A Sub-AUA or Sub-KUA accesses those services through an existing AUA or KUA. UIDAI’s new LITE framework aims to make that route faster for low-volume entities.
On 29 September 2026, UIDAI announced five initiatives at Aadhaar Samvaad in Kolkata. Most coverage focused on face authentication for ration distribution. For fintechs and lenders, the more consequential item is a lighter Sub-AUA/Sub-KUA onboarding route.
This briefing explains the AUA KUA structure, what UIDAI has said about LITE, what it has not yet said, and what regulated entities should do while the details arrive.
What UIDAI Announced on 29 September 2026
According to the PIB release, UIDAI launched five initiatives:
- Face Authentication for ePDS, built with the Department of Food and Public Distribution and NIC, for consent-based, contactless authentication in the public distribution system.
- SWIK Portal 2.0, which lets non-government entities submit Aadhaar authentication proposals directly to the concerned ministries or departments.
- The Sub-AUA/Sub-KUA (LITE) framework for government and eligible non-government entities with lower authentication volumes.
- A Token Management System for UIDAI’s state and regional offices.
- A revamped UIDAI website supporting 13 languages, with expansion to 23 planned.
PIB says the LITE framework lets such entities use “the authentication infrastructure of an existing AUA/KUA, enabling simpler and faster onboarding in real time without establishing any authentication infrastructure.” Minister of State Jitin Prasada and UIDAI CEO Saurabh Vijay spoke at the event.
AUA, KUA, Sub-AUA, Sub-KUA and ASA Explained
The Aadhaar (Authentication and Offline Verification) Regulations, 2021 define the roles precisely:
- Authentication Service Agency (ASA): “a licensed entity providing necessary infrastructure for ensuring secure network connectivity and related services”. ASAs carry requests between requesting entities and UIDAI’s data centre.
- AUA: “a requesting entity that uses the Yes/No authentication facility provided by the Authority”. The answer is only a match or no match.
- KUA: “a requesting entity which uses e-KYC authentication facility provided by the Authority”. A successful e-KYC returns demographic data and a photograph, with the resident’s consent.
- Sub-AUA: a requesting entity that uses Yes/No authentication “through an existing AUA”.
- Sub-KUA: a requesting entity that uses e-KYC “through an existing KUA”.
The KUA full form, e-KYC User Agency, explains the difference: a KUA receives identity data, so its obligations on storage and security are heavier.
Two rules matter for Sub-AUAs. Regulation 14 requires an AUA or KUA to obtain UIDAI’s approval before appointing a third party as a Sub-AUA or Sub-KUA. Regulation 15 makes the requesting entity jointly and severally liable with its Sub-AUAs for non-compliance. In February 2025, UIDAI’s Circular 2 of 2025 tightened the Sub-AUA application and joint undertaking, including Aadhaar Data Vault and HSM requirements.
The Good Governance Rules Behind Non-Government Access
On 31 January 2025, MeitY notified the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025. PIB said the amendment enables “both government and non-government entities to avail Aadhaar authentication service” for public-interest purposes, including e-commerce, travel, tourism, hospitality and health.
The process: the entity applies to the concerned ministry or department, UIDAI examines the application, MeitY approves on UIDAI’s recommendation, and the ministry notifies the entity. SWIK Portal 2.0 is the upgraded front end for that process.
This matters because it widened the pool of non-government entities that can seek Aadhaar authentication at all. The LITE framework addresses the next question: how a low-volume entity can start without building AUA-grade infrastructure.
What the LITE Framework Changes, and What Is Still Unknown
What is known from the PIB release:
- LITE targets government and “eligible” non-government entities with low authentication volumes.
- It relies on an existing AUA/KUA’s infrastructure rather than the entity’s own.
- UIDAI describes onboarding as real-time.
What is not yet public, as of 7 October 2026:
- Eligibility criteria and the volume threshold that defines “low volume”.
- Whether LITE entities will hold their own Sub-AUA codes and licence keys.
- How liability, audit, and data-vault obligations will be split between the AUA/KUA and the LITE entity.
- Whether regulated financial entities fall within “eligible”.
- Fees.
There is a precedent. UIDAI’s Circular 03 of 2023 allowed government entities with under 50,000 annual transactions to use their AUA/KUA’s licence keys without a separate Sub-AUA/Sub-KUA code. LITE may extend similar logic, but until UIDAI publishes operating rules, no entity should assume eligibility. Watch UIDAI circulars and the SWIK portal.
Access Routes Compared
| Route | Who it suits | Infrastructure needed | Main obligations | Status |
|---|---|---|---|---|
| Own AUA/KUA | High-volume entities permitted by law | ASA connectivity, HSM, Aadhaar Data Vault, audits | Full UIDAI compliance | Established |
| Sub-AUA/Sub-KUA | Entities using a partner AUA/KUA | Integration with AUA/KUA; vault and security per joint undertaking | UIDAI approval; joint and several liability | Established, tightened Feb 2025 |
| Sub-AUA/Sub-KUA LITE | Low-volume government and eligible non-government entities | Uses existing AUA/KUA infrastructure | Not yet published | Announced 29 Sep 2026 |
| Offline verification (paperless e-KYC XML, QR code) | Entities verifying without authentication | XML/QR validation, consent capture | Consent and offline verification obligations under the 2021 Regulations | Established |
Offline verification is defined in the 2021 Regulations as verifying identity “without authentication, through offline modes”. For many fintech journeys, it and DigiLocker remain the practical routes.
What Regulated Entities Should Do Now
- Map your current route. Are you an AUA/KUA, a Sub-AUA/Sub-KUA, or using offline verification or DigiLocker? Document the legal basis under your sector rules, with reference to RBI’s 2025 KYC Directions.
- Review AUA/KUA partner contracts against Circular 2 of 2025, especially vault, HSM, audit, and incident clauses.
- Audit Aadhaar number handling. Masking, vault storage, and log retention are the controls an audit will test first.
- Align consent with DPDP. The DPDP Rules’ notice and consent provisions apply from 14 May 2027.
- Keep alternatives live. Offline XML, QR, and DigiLocker, combined with reduced dependence on any single route.
- Watch for LITE rules before changing architecture.
For broader context, our pillar covers the full stack, and the guide covers proof of address options.
Where BeFiSc fits: IDProof gives onboarding teams Aadhaar-based routes, DigiLocker document fetch, face match, and liveness through one integration. That lets you run several verification paths side by side while UIDAI finalises LITE. Book an IDProof demo to see these routes on a sample journey.
Key Takeaways
- UIDAI announced a Sub-AUA/Sub-KUA LITE framework on 29 September 2026 for low-volume government and eligible non-government entities.
- LITE uses an existing AUA/KUA’s infrastructure for real-time onboarding; eligibility, thresholds, and liability rules are not yet published.
- The 2025 Good Governance amendment rules opened Aadhaar authentication to non-government entities through ministry approval; SWIK 2.0 streamlines that process.
- Sub-AUAs already carry joint and several liability with their AUA and tighter undertakings since February 2025.
- Regulated entities should audit current routes, partner contracts, and Aadhaar data handling now, and wait for LITE rules before re-architecting.
Frequently Asked Questions
Can NBFCs use the LITE framework?
UIDAI has not yet published eligibility criteria. NBFCs should continue with their current permitted route until operating rules clarify who qualifies.
What is the Sub-AUA/Sub-KUA LITE framework?
It is a UIDAI framework announced on 29 September 2026 that lets low-volume government and eligible non-government entities onboard through an existing AUA/KUA’s infrastructure. Detailed rules are pending.
What is a Sub-AUA?
A Sub-AUA is an entity that uses Aadhaar Yes/No authentication through an existing AUA rather than connecting to UIDAI directly. The AUA needs UIDAI approval to be appointed, and both share liability.
What is the difference between AUA and KUA?
An AUA receives only a Yes/No answer from Aadhaar authentication. A KUA uses e-KYC and receives the resident’s demographic data and photograph with consent, so its storage and security obligations are greater.
Conclusion
The LITE framework signals that UIDAI wants Aadhaar authentication to reach smaller entities without each building heavy infrastructure. For the financial sector, it could lower the cost of the Sub-AUA route, but only once eligibility and liability rules are clear.
Until then, the sensible posture is preparation: know your AUA KUA route, tighten Aadhaar data handling, align consent with DPDP, and keep alternative KYC paths working.
See Aadhaar routes, DigiLocker, and liveness in an IDProof demo
